ClawHub
Back to skill

Security audit

小红书视频深度总结(本地)

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent local video transcription and summarization helper, but it asks for broad network fetching and persistent knowledge-base writes without enough scoping or user control.

Review before installing. Use it only on Xiaohongshu video links you trust, run it in a contained working directory, avoid providing browser cookies unless you understand the account-access risk, and confirm any Obsidian or IMA write targets before allowing archival.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/run.py:62
Finding

Unrestricted URL Processing May Permit Access to Unintended Network Resources

Content
View full analysis

Vulnerability Details

File Location: scripts/run.py:62-66, scripts/run.py:91-93, and scripts/run.py:123-126
Vulnerability Type: Server-Side Request Forgery through insufficient URL validation
Risk Level: Medium

Vulnerable Code:

python
def extract_meta(url):
    """Use yt-dlp to extract metadata and the direct video URL."""
    log("1/4 Extracting metadata (yt-dlp) ...")
    out = subprocess.run(
        [VENV_PY, YTDLP, "--dump-json", "--no-warnings", url],
        capture_output=True, text=True,
    )
python
def download_video(video_url):
    log("2/4 Downloading video (curl) ...")
    r = subprocess.run(
        ["curl", "-s", "-L", video_url, "-o", "xhs_temp.mp4"],
        check=True
    )
    if not os.path.exists("xhs_temp.mp4") or os.path.getsize("xhs_temp.mp4") < 1024:
        raise RuntimeError("Video download failed or file is too small")
python
url = sys.argv[1]

meta = extract_meta(url)
if not meta["video_stream_url"]:
    print("Error: video_stream_url was not found.", file=sys.stderr)
    sys.exit(1)

Technical Analysis

The declared purpose is to process Xiaohongshu video links, but the script does not validate the scheme, hostname, port, resolved IP address, or redirect destination of the user-supplied URL. The URL is passed directly to yt-dlp.

The media URL returned by yt-dlp is also trusted without validation and passed to curl with -L, which follows redirects. If yt-dlp accepts the supplied resource or returns an attacker-controlled media URL, the process can be induced to issue requests beyond the Skill's declared Xiaohongshu scope.

Although argument-list subprocess execution prevents ordinary shell metacharacter injection, it does not prevent network destination abuse. No restrictions exclude loopback, link-local, private, reserved, or cloud metadata addresses. There are also no explicit connection timeout, ...[truncated 1782 chars]

Remediation
View remediation

Remediation Suggestions

  1. Parse input URLs with a standard URL parser and permit only https.
  2. Enforce an explicit allowlist of expected Xiaohongshu domains and reject credentials, unusual ports, malformed hostnames, and unsupported schemes.
  3. Resolve destination hostnames and reject loopback, private, link-local, multicast, reserved, and unspecified IPv4 and IPv6 ranges.
  4. Apply the same validation to the direct media URL returned by yt-dlp.
  5. Do not use unrestricted automatic redirects. Validate each redirect destination before following it.
  6. Add curl controls such as connection timeout, total transfer timeout, maximum file size, protocol restrictions, and failure on HTTP errors.
  7. Run network processing in a sandbox with egress restricted to the minimum hosts required for Xiaohongshu media retrieval.
  8. Store downloads in a newly created private temporary directory rather than a predictable file in the current working directory.
  9. Reject non-media responses and verify the downloaded content type and container before passing it to FFmpeg.

T08 · Insecure Dependencies

Warning
Location
README.md:8
Finding

Unpinned Third-Party Dependencies Create a Mutable Supply-Chain Risk

Content
View full analysis

Vulnerability Details

File Location: README.md:8 and SKILL.md:62
Vulnerability Type: Unpinned package installation without integrity verification
Risk Level: Medium

Vulnerable Code:

bash
~/.workbuddy/binaries/python/envs/default/bin/python -m pip install imageio-ffmpeg yt-dlp faster-whisper huggingface_hub
bash
VENV_PY=~/.workbuddy/binaries/python/envs/default/bin/python
$VENV_PY -m pip install imageio-ffmpeg yt-dlp faster-whisper huggingface_hub

Technical Analysis

The installation instructions request the latest package versions available from the configured Python package index. No exact versions, lock file, hashes, or trusted-index requirements are provided.

As a result, the effective code installed for this Skill can change after the Skill package has been audited. Installation may also resolve mutable transitive dependencies that are not identified in the repository. A compromised upstream release, package-index account, dependency, or index configuration could therefore introduce unreviewed code into the managed Python environment.

These packages are imported or executed by the Skill. In particular, imageio_ffmpeg and faster_whisper are imported in-process, while yt-dlp and the FFmpeg executable are invoked during media processing. Code from compromised dependencies would consequently execute with the permissions of the user running the Skill.

Attack Path

  1. A documented dependency or one of its transitive dependencies publishes a compromised release, or the configured package index is redirected to an untrusted source.
  2. A user follows the documented installation command.
  3. pip resolves and installs the currently available versions because no exact versions or hashes constrain the result.
  4. The compromised package executes code during installation, import, model initialization, or media processing.
  5. That code gains the filesystem, network, process, ...[truncated 928 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin every direct dependency to a reviewed exact version.
  2. Generate and distribute a lock file that includes resolved transitive dependencies.
  3. Require cryptographic hashes for downloaded artifacts, such as through a hash-locked requirements file and pip --require-hashes.
  4. Document and enforce the trusted package index rather than relying on arbitrary local pip configuration.
  5. Review package provenance, release signatures where available, and known vulnerability advisories before updates.
  6. Use a dedicated virtual environment for this Skill instead of a shared managed environment.
  7. Pin and verify the Whisper model and downloaded FFmpeg binary artifacts as well as Python packages.
  8. Perform dependency updates through a controlled review and testing process rather than automatically installing the latest releases.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (11)

Tp4

High
Category
MCP Tool Poisoning
Confidence
92% confidence
Finding

代码与描述前半部分基本一致：确实面向视频 URL，使用 yt-dlp 获取元数据，下载视频，提取音频，并用 faster-whisper 在本地转写，输出元数据和逐字稿，也符合“专用于小红书视频笔记”的范围。但描述的核心结果之一是“再由 LLM 做结构化深度总结”，而该代码中完全没有任何 LLM 调用、总结逻辑、结构化输出步骤或总结文件产物。因此其实际主行为更接近“视频笔记采集+转写归档”，而不是完整的“深度总结”技能。根据标准，这属于描述与实际能力存在实质差异。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding

The usage instruction tells users to say a specific Chinese phrase to invoke the skill, with no indication that other languages are supported or that language selection is optional. This is a natural-language policy concern because it imposes a locale/language requirement without documented opt-in or justification.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill declares shell, environment, and file-write capable behavior but does not constrain or disclose tool scope in the manifest. That increases the blast radius of accidental or unsafe execution because a caller cannot tell from the manifest that the skill may run commands and modify local files.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The workflow instructs archiving extracted content into Obsidian and IMA knowledge-base folders, which extends beyond simple local summarization and introduces file modification and propagation of third-party content into other systems. Without clear scope restrictions, path constraints, and confirmation, this can overwrite user data, leak sensitive notes into synced knowledge bases, or store scraped content in unintended locations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill instructs writing extracted content into local knowledge-base folders without prominently warning that it will modify user files. In a skill that processes third-party content and may be run automatically, silent writes to persistent note repositories can cause unwanted data contamination, sync sensitive content to cloud-backed vaults, or overwrite existing files.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The manifest explicitly advertises 'yt-dlp 拉取视频（无需 cookie）', implying unauthenticated retrieval as part of the intended scope. The documented fallback instructs use of browser cookies for logged-in access when the server requires it, which is a materially more sensitive capability than the manifest presents.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/run.py (reported line 56)May include surrounding context.

python
def extract_meta(url):
    """用 yt-dlp 抽元数据 + 视频直链。"""
    log("1/4 抽取元数据 (yt-dlp) ...")
    out = subprocess.run(
        [VENV_PY, YTDLP, "--dump-json", "--no-warnings", url],
        capture_output=True, text=True,
    )

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
84% confidence
Finding

The script downloads a second-stage URL extracted from remote metadata and passes it directly to curl with automatic redirect following. In an agent or server environment, this can be abused for SSRF-like access to internal resources, unintended downloads from attacker-controlled hosts, or fetching oversized content that leads to resource exhaustion; the skill context increases risk because it is explicitly designed to ingest untrusted external links automatically.

Content

Scanner excerpt · scripts/run.py (reported line 88)May include surrounding context.

python
def download_video(video_url):
    log("2/4 下载视频 (curl) ...")
    r = subprocess.run(["curl", "-s", "-L", video_url, "-o", "xhs_temp.mp4"], check=True)
    if not os.path.exists("xhs_temp.mp4") or os.path.getsize("xhs_temp.mp4") < 1024:
        raise RuntimeError("视频下载失败或文件过小")

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/run.py (reported line 95)May include surrounding context.

python
def extract_audio(ffmpeg):
    log("3/4 提取音频 (ffmpeg) ...")
    subprocess.run(
        [ffmpeg, "-i", "xhs_temp.mp4", "-vn", "-acodec", "libmp3lame",
         "-q:a", "2", "xhs_temp.mp3", "-y", "-loglevel", "error"],
        check=True,

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The transcription call forces language="zh", which constrains the skill to a specific language without offering user opt-in or configuration. This matches the locale-policy violation category because the file does not present a language choice or explain a justified region-specific limitation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The description says the skill is '全部在本地免费完成' and emphasizes local processing, but the documented dependency path explicitly says the whisper model may be pulled from ModelScope when Hugging Face is unreachable. While the main inference is local, acquiring required assets from external services is still part of the described operation and slightly exceeds the purely local framing.

Content

No source excerpt is available for this finding.